arXiv: 1501,04348v2 [cs.SI] 1 Oct 2015 


The cost of attack in competing networks 


B. Podobnik, 1 ’ 2 ’ 3 D. Horvatic, 4 T. Lipic, 1 ’ 5 M. Perc, 6 ’ 7 J. M. Buldu, 8 ’ 9 and H. E. Stanley 1 

1 Center for Polymer Studies and Department of Physics, Boston University, Boston, MA 02215 
2 Faculty of Civil Engineering, University of Rijeka, 51000 Rijeka, Croatia 
3 Zagreb School of Economics and Management, 10000 Zagreb, Croatia 
4 Faculty of Natural Sciences, University of Zagreb, 10000 Zagreb, Croatia 
5 Rudjer Boskovic Institute, Centre for Informatics and Computing, Zagreb, 10000, Croatia 
6 Faculty of Natural Sciences and Mathematics, University of Maribor, Koroska cesta 160, 2000 Maribor, Slovenia 
7 Department of Physics, Faculty of Sciences, King Abdulaziz University, Jeddah, Saudi Arabia 

8 Center for Biomedical Technology (UPM), 28223 Pozuelo de Alarcon, Madrid, Spain 

9 Complex Systems Group, Rey Juan Carlos University, 28933 Mostoles, Madrid, Spain 

Real-world attacks can be interpreted as the result of competitive interactions between networks, 
ranging from predator-prey networks to networks of countries under economic sanctions. Although 
the purpose of an attack is to damage a target network, it also curtails the ability of the attacker, 
which must choose the duration and magnitude of an attack to avoid negative impacts on its 
own functioning. Nevertheless, despite the large number of studies on interconnected networks, 
the consequences of initiating an attack have never been studied. Here, we address this issue by 
introducing a model of network competition where a resilient network is willing to partially weaken 
its own resilience in order to more severely damage a less resilient competitor. The attacking 
network can take over the competitor nodes after their long inactivity. However, due to a feedback 
mechanism the takeovers weaken the resilience of the attacking network. We define a conservation 
law that relates the feedback mechanism to the resilience dynamics for two competing networks. 

Within this formalism, we determine the cost and optimal duration of an attack, allowing a network 
to evaluate the risk of initiating hostilities. 


I. INTRODUCTION 

Recent research carried out on competing interacting 
networks m does not take into account the fact that 
real-world networks often compete not only to survive 
but also to take over or even destroy their competitors 
[7]. For example, in international politics and economics, 
when one country imposes economic sanctions on an¬ 
other, feedback mechanisms can cause the country im¬ 
posing the sanctions to also be adversely affected. The 
decision by a wealthier country to keep military spend¬ 
ing at a high level long enough to exhaust its poorer 
competitor can also contribute to its own exhaustion [8]. 
Similarly, in warfare, any attack depletes the resources of 
the attacking force and can elicit a counter-attack from 
the competing force [9]. Also, in nature, an incursion 
between species can alter the dynamics of predator-prey 
interaction m ■ 

Although, these competing interactions are a 
widespread real-world phenomenon, current studies 
analyze only effects of attack on attacked networks, but 
disregarding its effect on the external attacking network. 
For example, for both single and interactive networks, 
existing studies on network robustness report that every 
network, regardless of the size and architecture, eventu¬ 
ally can be destroyed Q3HIZ]. But, what then prevents a 
network from attacking a weaker competitor or, what is 
the optimal moment for initiating or ending an attack? 
In order to identify the factors that inhibit a network 
from attacking and demolishing a weaker competitor 
and to determine the optimal moment and duration 
of an attack, we develop a theoretical framework that 


quantifies the cost of an attack by connecting the 
feedback mechanisms and resilience dynamics between 
two competing dynamic networks with differing levels of 
resilience nsnu]. 


II. THEORETICAL FRAMEWORK 

We introduce a general methodology that can be ap¬ 
plied to networks of any size and structure. First, as an il¬ 
lustrative example, we describe two competing Barabasi- 
Albert (BA) networks [20 which we designate network 
S and network W. This model differs from the single 
network BA model in that the two interconnected net¬ 
works have both intra-network and inter-network links 
m ■ One real-world example of this kind of network in¬ 
teraction is firms in an economic network that link with 
other firms both domestically and abroad. 

Using the preferential attachment (PA) rule [20fl22] , 
we generate networks S and W starting with no nodes in 
each network. At each time step we add a new node that 
connects with ms existing nodes in network S and with 
mw,s existing nodes in network W, where the probability 
of each connection depends on the total node degrees 
in networks S and W. Similarly, using the PA rule we 
connect a new node in network W with mw nodes inside 
network W and with ms,w = ™w,s nodes in network S. 

In a broad class of real-world networks, nodes can fail 
either due to inherent reason m or because their func¬ 
tionality depends on their neighborhood [23, 24] - Hence, 
any node in either of the two networks, e.g., a node ni in¬ 
side network S with ks neighbors in its own network and 
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FIG. 1: Attacks, failures, takeovers and their cost on the attacking network. In (a), we assume that each node in both the more 
resilient (stronger) network S and the less resilient (weaker) network W is described by the same failure probability. Different 
nodes spend different times during internal failure—the less opaque a node is, the more time it spends in internal failure. In 
(b), if a node in the weaker network W remains inactive more than some threshold time, it will be taken over by the stronger 
network S. However, network S pays for this takeover with a reduction of its resilience. 


kw,s neighbors in network W, can fail at any moment, 
either internally—independent of other nodes—with a 
probability pi or externally with a probability p 2 - Node 
rii externally fails with a probability P 2 when, similar 
to the Watts model [24], the total fraction of its active 
neighbors is less than or equal to a fractional threshold 
T which is equal for all nodes in both networks. The 
larger the T value, the less resilient the network. We as¬ 
sume that one of the two networks is more resilient than 
the other, distinguishing between strong network S and 
weak network W. We do so by assigning different frac¬ 
tional thresholds to the strong and weak networks, Ts 
and TV, respectively, with Ts < Tw • As in Ref. [23] . 
we assume that an internally-failed node in network S 
or network W recovers from its last internal failure af¬ 
ter a period r. Consecutive failures of the same node 
stretch the effective failure times and introduce hetero¬ 
geneity into the distribution of inactivity periods. Since 
in real-world networks it is dangerous for nodes to be in¬ 
active, we allow the strong network to take over nodes in 
the weak network when a node rii spends more time in 
internal failure than nr, where n is a constant. Figure [l] 
qualitatively shows the interaction process. 


III. RESULTS 

We quantify the current collective state of the strong 
and weak networks in terms of the fraction of active 
nodes, fs and /yp, respectively 23. [25] 26 . We as¬ 
sume that initially on both networks have internal and 
external failure probability values of p\ = px and ^ 2 , 
respectively. Figure [2|a) shows a two-parameter phase 
diagram for each network in which the hysteresis is com¬ 
posed of two spinodals separating two collective states, 


i.e., the primarily “active” and the primarily “inactive.” 
Figure [2jb) shows that increasing the value of p\ leads 
to catastrophic first-order phase transitions in both net¬ 
works. When each network recovers (i.e., when pi is de¬ 
creased to previous values), the fraction of active nodes 
returns to an upper state. Nevertheless, the critical point 
in the recovery is well beyond the point at which the 
network collapses. Figure [2jb) also shows (solid line) 
that the initial choice of parameters makes network S 
more resilient to network fluctuations in the value of p\ 
and that the fluctuation needed to initiate the collapse 
of network S (pf = pf c — px ) is much larger than the 
fluctuation needed to initiate the collapse of network W 
(pY = pYc ~ Px)- Furthermore, network W is closer to 
a critical transition than network S. 

Because network S has a higher resilience than net¬ 
work W and can more easily withstand fluctuations, S 
could induce the collapse of W by increasing p \, but only 
if the fraction of its active links is not dramatically re¬ 
duced. Figure [2jb) shows how when network S attacks 
network W by increasing p\ to ~ 0.002 the weak net¬ 
work becomes abruptly dysfunctional. Figure |2jb) also 
shows that when the values of pi are reset to their pre¬ 
attack levels the collapse of network W is permanent (red 
dashed line) and, if it ceases its attack, the recovery of 
network S is complete and all of its inactive nodes are 
reactivated (see blue dashed line Figure 2(b)). Similarly, 
when economic sanctions in a financial system are lifted 
the weak economies are not restored but the strong eco¬ 
nomics recover after suffering little damage. 

Figure |2| c) shows a modified competing network struc¬ 
ture in which there are two interconnected Erdos-Reny 
networks m with inter-network links randomly chosen. 
Although this structure quantitatively differs from the 
phase diagram of competing BA networks, the same kind 
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of transition occurs in the random configuration. This in¬ 
dicates the generality of these critical transitions in com¬ 
peting networks. We obtain similar results when degree- 
degree correlations are introduced between the links con¬ 
necting both networks. Figure [2^d) shows nodes in the 
strong network linking with nodes in the weak network 
only when they are of similar degree (i.e., “assortative 
mixing” [28]). As in the other configurations, the bet¬ 
ter position of the attacker enables the strong network to 
destroy the weak one and then return safely to its initial 
state. 



FIG. 2: Attack strategy between two competing networks 
with different resilience levels and intra/inter link architec¬ 
ture. Shown are fractions of active nodes. The most resilient, 
strong network S (with Ts = 0.3) endangers and partially de¬ 
stroys its own nodes by increasing their internal failure prob¬ 
ability pi in order to more severely damage the least resilient 
network W (with Tw — 0.7). Each of S and W has the hys¬ 
teresis composed of two spinodals, representing attacking and 
recovery phase. The recovery time is r = 50 and the takeover 
and cost mechanisms are disregarded, (a) Attacking strat¬ 
egy between two competing BA networks with parameters: 
ms — mw — 3 and ms,w — rnw,s — 2. Strong network 
S wants to bring W in parameter space between hystereses 
of W (black lines) and S (white lines) where S is predomi¬ 
nantly active and W is predominantly inactive (see, b). Dark 
red (blue) is parameter space where both S and W are active 
(inactive), (b) For p 2 = 0.9, fraction of active nodes in the 
strong fs (blue lines) and weak fw (red lines) networks as a 
function of the internal failure probability pi . Hysteresis is a 
result of increasing pi from zero to one and then decreasing 
it back to zero. The increase of p± accounts for the attacks 
and the decrease for a repair of the network, (c) Same case as 
(a) but for two randomly connected competing Erdos-Renyi 
networks, (d) Same case as (c) but with an assortative mix¬ 
ing in the connection between networks: nodes with degree 
di link, with probability l/|di — d 2 + 1|, with nodes in the 
other network with degree cfe- 


A. Mean field theory 


Using mean-field theory we analytically describe the 
attack-and-recovery process between two interconnected 
networks with random regular topologies where all nodes 
within the same network have the same degree. We as¬ 
sume that each node in network S is linked with ks nodes 
in its own network and kw,s nodes in network W. Sim¬ 
ilarly, each node in network W is linked with kw nodes 
inside network W and k$,w nodes in network S. In both 
networks the fraction of failed nodes is a = 1 — /, where / 
is the fraction of functional nodes. We can approximate 
the values of a at each network by 

a s = P*s,i+PsA 1 ~P*s,i) E s (1) 

aw = Pw,i +Pvr,2(l - Pw,i) E w, (2) 

where p* s x = 1 — exp(— ps,w) [23] denotes the average 
fraction of internally failed nodes and ps, 2 E s denotes the 
probability that a node in network S has externally failed, 


E s = 


ts j 
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Here ts represents the absolute threshold of network S 
simply related to the fractional threshold Ts as Ts = 
ts/(ks + kw,s) : a node in network S can externally fail 
with a probability ps, 2 only when the number of active 
neighbors in both network S and network W is less than 
or equal to ts- Similarly, we obtain Ew for network W by 
replacing S with W, and vice versa, in Eq. <i- Finally, 
we set network S to be more resilient than network W, 
by setting ts/{ks + kw,s) < tw/{kw + ks,w )• 

The analytical results of Fig. 3|a) indicate that when 
network S increases the internal failure probability psp 
and so p* s 1 in an effort to damage network W it also 
causes partial damage to itself. Although it first seems 
that increasing p* s 1 reduces more active nodes in network 
S than in network W, when p* s ± > 0.18 the fraction of 
active nodes in network W drops sharply and eventually 
fs > fw • This attack strategy by network S is thus 
effective. If p* si > 0.33, however, network S undergoes 
a first order transition that leads to collapse, a situation 
that network S clearly must avoid. 

Inspecting the recovery of the previous internal failure 
probability values after the attack we find that the frac¬ 
tion of active nodes in both networks exhibit a hysteresis 
behavior. Note that when the transition at p* s 1 ~ 0.33 is 
surpassed neither network is able to restore its function¬ 
ing to the levels previous to the attack. 

The analytical results indicate that attacking network 
S is effective only for certain values of p* s t . Thus network 
S should increase p* s x only as long as the damage to 
network W continues to be greater than the damage to 
itself, i.e., only when A aw > A as- Figure [3](b) shows 
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the region in which attacks by network S are effective 
by showing the fraction of failed nodes in both networks 
in a two-dimensional phase space as the value of p* s 1 is 
increased. Two solid lines with a slope of one indicate the 
region in which an attack by network S is effective. When 
the slope of function aw = f(as) is greater than one 
(the region between the two shaded lines), increasing p* s 1 
produces more damage in network W than in network S 
and is thus an effective attack strategy. 

In order to measure the effect of capturing nodes from 
a competitor network and how takeovers can modify the 
resilience properties of a network, we design a model in 
which network S is again more resilient than network W 
(Ts < Tw ) and where node rii of network W is taken over 
by network S if its internal failure time exceeds nr, where 
r is a certain failure time and n a constant. Note that 
the longer a node in network W remains inactive (i.e., 
the higher the value of n), the higher the probably that 
it will be acquired by network S. Real-world examples 
of this mechanism include sick or disabled prey in an 
ecological system 29. |30] or countries whose economic 
systems remain in recession for too long a period. 

B. Take over and conservation laws 


variables: the total number of links in the network— 
as defined in conservation biology (3TJE2 — and the re¬ 
silience of the network. Note that if two networks have 
the same number of links but different resiliencies their 
wealth is not equal. Note also that when network S ac¬ 
quires a node of degree kw,i from network W the overall 
resilience of network S decreases because it has acquired 
a weaker node. Thus network S pays a instantaneous, 
collective cost through a feedback mechanism that de¬ 
creases its resilience from an initial threshold Ts to a 
new threshold T' s . 

One of the important issues in dynamic systems that 
have a critical point as an attractor is whether a conser¬ 
vation of energy is required in local dynamic interactions 
j33h35] . To quantify how threshold T' s changes in com¬ 
peting networks, we define a conservation law that relates 
the feedback mechanism to the resilience dynamics as 

N ( k s ) (T' s - T s ) = k W4 (T w - T ' s ). (4) 

Here N is the size of the strong network, (ks) its average 
degree, and kw,i the degree of the node that has been 
taken over. Thus, we assume that the more important 
the acquired node (i.e., the larger its degree kw,i ), the 
greater the cost to the resilience of network S, making it 


To evaluate the acquisition costs in both networks we 
define network wealth (capital) as proportional to two 



FIG. 3: Identifying the optimal parameters for attacking a 
weak network. Analytical approach. Strong network S (less 
vulnerable) uses its own probability of internal failures psi to 
cause damage in weak network W and, unavoidably, induce 
a partial self-destruction. Model parameters are: ks = 20, 
ks,w — kw,s — 10, ks = 5, ts = 10, tw — 10, ps, 2 — 
pw ,2 = 0.8, and Pwp =0.05. In (a), fraction of active nodes in 
network S and W, fs — 1 — as and fw — 1 — clw, respectively. 
Strong network S (blue) deliberately initiates its own failures 
(increasing Psp) to create larger damage in a weak (more 
vulnerable) network W (red). Note that the fraction of active 
nodes exhibits a hysteresis behavior for both networks, with 
a critical point at pc ~ 0.33. In (b), we investigate when 
S should stop attacking W by increasing its probability of 
internal failure Ps,i- Shown are the fractions of failed nodes, 
as = 1 — fs and aw = 1 — fw ■ Between points C and D 
(dashed lines), an increase of p* s ^ induces more failures in the 
weaker network, leading to a comparative benefit. Beyond 
point D, the attack is not worthwhile for network S since it 
suffers the consequences more intensely than its competitor. 



FIG. 4: Cost and takeover mechanisms in two competing 
BA networks, (a) Threshold T' s of network S as a function 
of time for two competing BA networks with n — 2.5 and 
r = 50. Fluctuations in the evolution of T' s are a consequence 
of the degree of the acquired node: the higher the degree the 
higher the increase of T' s . (b) Fraction of takeovers and final 
threshold as a function of the time nr required to acquire a 
node from the weak network, with r = 50. As n increases, 
the number of takeovers decreases to zero. At the same time, 
the resilience of network S tends to the initial value Ts = 0.3. 
(c) Due to takeovers the fraction of active nodes in the more 
resilient network S can increase to values higher than one. In 
this example, network W is irreversibly damaged after pi is 
restored to its initial value. 
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more vulnerable to future attacks. As a result, when a 
predator (strong) network S increases its size N and its 
degree (fc s ), its acquisition cost, T' s — Ts, will decrease. 

Here we quantify how threshold T' s of the stronger net¬ 
work changes in competing networks where we assume 
that threshold Tw of the weaker network does not change 
because every node has the same threshold. The stronger 
network S has the initial number of nodes Ns , the aver¬ 
age degree (ks). After a multiple takeovers, where S took 
over nodes n Wt i, n w ^ 2 , n w ^ n with degrees k Wj i, k W: 2 , 
•••5 k WiU , respectively, by using Eq. (4) we obtain 

Ji, _ {k w , 1 + k w , 1 + ... + k w ,n)T w + N s (ks)T s ^ 
Ns{ks) + k W: i + k Wj % + ... + k w , n 

Figure [4ja) shows that when network S acquires nodes 
in network W the threshold T' s of network S is increas¬ 
ingly affected as time passes. In this example, a node in 
network W is taken over by network S when the node is 
in failure state longer than nr time steps, where n = 2.5 
and r = 50. Note that as network S acquires weak nodes, 
its threshold T' s increases and it becomes more vulner¬ 
able. Figure |4jb) shows the interplay between the time 
required to acquire a node nr and the threshold T' s . Note 
that as nr increases, takeovers become increasingly rare 
and the final threshold of network S approaches its initial 
resilience, here Ts = 0.3. 

Figure Qc) shows that, if the example in Figure [2|b) is 
extended to include a takeover mechanism, a fraction of 
active nodes fs in network S—measured relative to the 
initial number of nodes in each network—reaches values 
higher than one, with a peak at p y —>> p z . Note that 
when attacks cease (e.g., when, in an economic system, 
sanctions are lifted) decreasing the value of pi , p z p w , 
the fraction of active nodes in network S increases but 
network W is left irreversibly damaged (see the closed 
hysteresis p' y ->■ p' z ->■ p' w ). 

C. Threshold diversity in competing networks 

Thus far we have studied competing interconnected 
networks in which there is only one threshold characteriz¬ 
ing each network. However, in real-world interconnected 
networks commonly the functionality of a node in a given 
network is not equally sensitive on the neighbors in its 
own and the other network. To this end, we assume that 
node rii in network S can externally fail with probabil¬ 
ity P 2 if the fraction of the active neighbors of node rii 
in network S is equal to or lower than some threshold 
Tsj or if the fraction of the active neighbors of node rii 
in network W is equal to or lower than some threshold 
Tw,s- We similarly define external failure in the less re¬ 
silient network W by replacing threshold Ts with Tw 
The functioning of each node is thus dependent on its 
neighbors in network S and network W, but with different 
sensitivities—different resilience to external fluctuations 

Figure [5|a) shows, for a given set of parameters, a 
two-parameter phase diagram of competing networks, a 


model that incorporates the threshold separation for ex¬ 
ternal failure but excludes takeover and feedback mech¬ 
anisms. This model resembles that in Fig. [2] but uti¬ 
lizes different configurations. Suppose network S sponta¬ 
neously activates at time to but, due to differences in the 
variables characterizing network S and network W, initi¬ 
ates a substitution mechanism, not a takeover. Thus each 
time node rii in network W spends a time period in an 
inactive mode that exceeds the substitution time —e.g., 
in ecology, a time period without food— rii is replaced 
by a new node from network S. Figure [5|b) shows the 
fraction of active nodes in each network calculated rela¬ 
tive to the initial number of nodes at time to- Fractions 
of active nodes of both networks exhibit a catastrophic 
discontinuity (a phase flip) at t ~ 2, 000, which is char¬ 
acteristic of a first-order transition. Since both networks 
are interdependent, substituting nodes from the less re¬ 
silient network W affects the functionality of network S 



FIG. 5: Quantification of the optimal attack duration. 

Model parameters are: ms — 6, mw — 3, ms,w — mw,s — 2. 
Similar as in Fig. [4] but now with two thresholds used for 
defining resilience of each network. External failure thresh¬ 
olds are Tw — 0.7, Ts — 0.3, and Ts,w — 0.4. In (a), we 
find the phase diagram in model parameters (pi,P2) where 
each network has its own hysteresis. The takeover mecha¬ 
nism is disregarded and recovery time is r = 50. In (b), for 
each network we show the time evolution of the fractions of 
active nodes with the takeover mechanism included where we 
use a takeover period of 1.5r, p± = 0.0004, and P2 = 0.6. 
At some point, S creates larger damage in a weak (less re¬ 
silient) network W than to itself, (c) Related with (b), as 
a result of the attack, both networks are damaged, but W 
is damaged more. We also show how the fractions change 
with decreasing p± during the recovery phase, (d) Early- 
warning signal for determining when the attack should be 
stopped, defined as the change in the ratio between two frac¬ 
tions, fi(t + At)/fa(t + At) — fi (t) /fa (t), where At = 20. 
The attack should be stopped when the indicator reaches the 
maximum. 

















6 




FIG. 6: Evaluating the effect of the cost mechanism. Model 
parameters are: ms — mw — 3, ms,w — rnw,s =» 2, p± m 
0.0004 p 2 = 0.6. (a) The cost of the attacking strategy with 
takeover mechanism additionally decreases network resilience. 
The fraction of active nodes exhibits more discontinuities than 
in the case where the cost of an attack was excluded (Fig. 5). 
This is a consequence of the larger change in the resilience of 
S due to inclusion of the cost mechanism, (b) The fraction 
of takeovers and threshold T' s of the stronger network S as a 
function of takeover time nr, with r = 50. 


even more dramatically than that shown in Fig. [2] Thus 
beyond some threshold we expect that additional weaken¬ 
ing of network W will also permanently damage network 
S. This demonstrates how dangerous an attacking strat¬ 
egy can be for an attacker in a system of interdependent 
networks, e.g., between countries that are at the same 
time competitors and economics partners. 

Figure |5jc) shows that when the attacks and substitu¬ 
tions cease, the fractions of active nodes in network S and 
network W reach points C r and C", respectively. If the 
probability of internal failure pi spontaneously decreases 
during the recovery period, because of network interde¬ 
pendence the functionality of network S is not substan¬ 
tially improved. The triumph of network S over network 
W has its price. In ecology, for example, although the 
population of each species tends to increase, a dominance 
strategy is risky, e.g., the extinction of a key species can 
trigger, through a cascade mechanism m gh], the ex¬ 
tinction of many other species m- 

Figure [5jd) shows the change in the ratio between the 
fraction of active nodes in network S and network W as a 
function of time. This ratio can serve as an early-warning 
mechanism [38] that indicates when attacks should be 
stopped. Optimally, the stopping time for attacks will 
be when the ratio reaches its maximum. 

Finally, Fig. [6ja) shows that when the feedback mech¬ 
anism (the cost of taking over) defined in Eq. © is 
included, the fraction of active nodes in each network 
exhibits an even richer discontinuous behavior than in 
Fig. [5|c), where the cost was excluded. After 50,000 
steps, because of the decrease in network S’s resilience 
after each substitute, the final fraction of active nodes in 
network S is substantially smaller than the correspond¬ 
ing fraction in Fig. |5jc) (i.e., when the cost is excluded). 
At the same time, Fig.plb) shows that an increase in the 
takeover time nr decreases the fraction of substitutes. 


IV. SUMMARY 

In conclusion, we have presented a theoretical frame¬ 
work based on resilience, competition, and phase tran¬ 
sitions to introduce a cost-of-attack concept that relates 
feedback mechanisms to resilience dynamics defined us¬ 
ing a linear conservation law. Our model for competing 
networks can be applied across a wide range of human 
activities, from medicine and finance to international re¬ 
lations, intelligence services, and military operations. 

We focus on a specific context where one more re¬ 
silient network attacks the less resilient competitor net¬ 
work. The model assumptions about the structure and 
dynamics for two interactive networks with competing 
interactions and different resilience levels have to be ad¬ 
justed in regard to different real world scenarios (see the 
electronic supplementary material, S4). 

The ability to measure attacker network resilience and 
its attack cost is crucial because every weakening of the 
resilience reduces the probability of the network survival 
under future attacks. For example, in political socio¬ 
economic systems a network-based approach for overcom¬ 
ing competing countries could be more effective by apply¬ 
ing economical sanctions than carrying out military ac¬ 
tions. Interdependent links established between countries 
during prosperous times can facilitate sanctions (inten¬ 
tional fluctuations) that are used as a weapon when more 
resilient countries try to overcome less resilient coun¬ 
tries. They can also facilitate the global propagation of 
economic recessions (spontaneous fluctuations). During 
long economic crises these interdependent links can be¬ 
come fatal for less resilient countries, whose weakness 
is enhanced by being underdogs in a global network-of- 
networks and, at the same time, whose resources can be 
captured by more powerful countries. 

Although, our proposed framework is suited for repre¬ 
senting the most simplest case of bilateral economic in¬ 
terdependence between just two countries (networks), it 
provides the basis for more general scenarios of alliances 
of more countries (networks). The concept of alliance 
where some countries unite in order to attack some other 
alliance is especially interesting when there is heterogene¬ 
ity in resilience of allied attacker countries. For example, 
economically most dominant countries can increase their 
dominance at the expense of their partners in the alliance 
or they can, on the other hand, depend on the alliance’s 
weakest country (see the supplementary material, S4 A). 

In addition to the intentional fluctuations characteris¬ 
tic of human societies, our methodology can also be ap¬ 
plied to a broad class of complex systems in which spon¬ 
taneous fluctuations occur, from brain functioning to eco¬ 
logical habitats and climate fluctuations [3U [37l [39H14]. 
The methodology is based on specific structure, dynamics 
and mechanisms of the model of networks with compet¬ 
ing interactions and different resilience levels, that have 
to be adjusted for different systems and contexts of ap¬ 
plication (see the supplementary material, S4). 
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Supplementary material: The cost of attack in competing networks 


SI. RESILIENCE DYNAMICS IN FINANCE 

Here we demonstrate that the resilience dynamics in fi¬ 
nance can be presented in terms of a conservation (linear) 
law, where the threshold is controlled by an asset-debt 
ratio. Recall that in our model a node externally fails 
with a certain probability when the total fraction of its 
active neighbors is equal to or lower than the fractional 
threshold The larger the X \ value, the less resilient 
the network. In quantifying the impact of a perturba¬ 
tion (attack) on the network, we shall demonstrate that 
the more severe the attack, the larger the impact on the 
network resilience. 

Suppose a bank rii has an interbank asset Af invested 
equally in each of its ki neighboring banks. Bank rii has 
also some asset A*, considered as a stochastic variable. 
Following Refs. BE], we define a bank to be solvent 
(active) when (1 — <fi)Af + Ai — Lf > 0, i.e., when the 
bank’s assets exceed its liabilities, Lf . Here (j) represents 
the fraction of inactive neighboring banks that rii can 
withstand and still function properly. Note that this </> is 
related to threshold as = 1 — 0, since we assume 
that the number of incoming links is equal to the number 
of outgoing links, Af = Lf . The larger the Ai value, the 
more stable the bank. Suppose that for each bank there 
is a linear dependence between Af , Ai , and the network 
degree k —e.g., that Af = ki and Ai = 0.5 ki. Then a 
bank is inactive when 1— T/ l = 0 = O.5 (Th = 0.5) or 
when at least 50% of its neighboring banks are inactive. 
Let us assume next that Ai increases due to an external 
perturbation Ai = 0.5 + e. Then the new threshold is 
equal to 

T'h = 0.5 — e/ki, (6) 

or 

ki{Th — T h ) * —e. (7) 


If the external perturbation is negative (positive), or 
alternatively, the asset increases (decreases) (Eq. ©), 
the threshold increases (decreases) and the resilience de¬ 
creases (increases). The larger the number of neighbors 
(ki), the smaller the change in the network resilience. 
Note that if the external perturbation attacking one node 
is shared not only by its neighbors but by the entire net¬ 
work with N nodes, then ki is replaced by N(ki) as in 
Eq. (4) in the paper. Note that if we replace the linear 
dependence between assets and degree with a non-linear 
(power-law) dependence, e.g., Af = kf, where a is a 
constant parameter, we obtain a similar relationship to 
Eq. ffl,kf(T h -T h ) = -e. 


S2. RESILIENCE DYNAMICS IN 
INTERCONNECTED NETWORKS 

We focus on a mean field approximation of the level of 
external and internal failures between nodes for two inter¬ 
connected networks. Every node has an internal failure 
probability p\ [3]—assumed, for reasons of simplicity, to 
be the same in both networks, pi r s = Pi,w = Pi- If 
each node in network S has ks links with nodes in its 
own network and kw,s links with nodes in network W, 
here we define that there must be more than ms nodes 
in network S and mw,s nodes in network W if the nodes 
in S are to function properly. In contrast, if the num¬ 
ber of inactive nodes in network S is < ms, the proba¬ 
bility that the node in network S will externally fail is 
P 2 - Similarly, if the number of inactive nodes in net¬ 
work W is < mw,s, the probability that the node in net¬ 
work S will externally fail is p 2 - To simplify we can use 
P 2 ,s = P 2 ,w — P 2 - We denote the time averaged fractions 
of failed nodes in network S and network W as as and 
aw, respectively. Using combinatorics, we calculate the 
probability that a node in network S will have a critically 
damaged neighborhood among its neighbors in S to be 
E s = “ a s) j - Similarly, we calcu- 

late the probability that a node in network S will have a 
critically damaged neighborhood among its neighbors in 
W to be E w = J2 T=o S - a w) j - The 

probability that a node will fail externally due to failures 
in network S (network W) is p 2 E s (p 2 E w ). If we denote 
the internal failures in network S by A, and the external 
failures by B, and the external failures in network W by 
C, then the probability that a randomly chosen node in 
S will fail is ai « P(A) + P(B) + P(C) - P(A)(P(B) + 
P(C))-P(B)P(C) + P(A)P(B)P(C). If we assume that 
A, B, and C are not mutually exclusive, but interdepen¬ 
dent events, we come to 

a s « p\ +P2(E s + E w ) -p* lP2 (E s + E w ) (8) 
- p 2 p 2 E s E w + p* lP2 P2E s E w . (9) 

where p\ = 1 — exp(— p\r), and as in Ref. [3] node j 
recovers from an internal failure after a time period r. 
Similarly, from the above equation we obtain the fraction 
of failed nodes aw in network W (either internally or 
externally failed) by interchanging S and W. 

S3. COUPLED BA INTERDEPENDENT 

NETWORKS WITH EQUAL CONNECTIVITY 
BUT DIFFERENT THRESHOLD 

We now focus on two interdependent BA networks 
with equal connectivity but different threshold, where 
Ts < Tw- Fig. [ST] shows that for each of the two in¬ 
terconnected networks the fraction of active nodes si¬ 
multaneously jumps from a stable state to another one. 
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Phase-flipping is obtained by setting the network close 
to a critical point that is reported for a single network in 
Ref. ^. Since the threshold in network S is substantially 
smaller than in network W, and so S is more resilient 
than network W, the fraction of active nodes in network 
S is larger than the fraction of active nodes in network 
W. Thus the volatile phase-flipping in network function¬ 
ality is more dangerous for network W than for network 
S. The fractions, as a function of time, can approximately 
model the populations of preys and predators and so be 
related to the periodic solutions of the Lotka-Volterra 
(predator-prey) equations [4]. 


S4. APPLICABILITY OF THE MODEL TO 
REAL WORLD SCENARIOS 

Most real world systems are composed of networks 
which interact with each other in different ways. In our 
model we focus on a specific context where one more 
resilient (strong) network (attack initiator) attacks the 
less resilient (weaker) competitor network (attack tar¬ 
get). The proposed model depends on the structure of 
two interactive competing networks and the defined dy¬ 
namics between initiating an attack against a competitor 
network and the consequences that might weaken the at¬ 
tack initiator resilience. Within this framework assump¬ 
tions about the structure and dynamics for two interac¬ 
tive networks with competing interactions and different 
resilience levels have to be adjusted in regard to different 
real world scenarios. 

For the structure of interactive networks we use 
multilayer network model distinguishing between intra¬ 
network and inter-network connections. Although in our 
analysis we focused on specific architectures of intra¬ 
network and inter-network connections, in general they 
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FIG. SI: Coupled interdependent networks with equal con¬ 
nectivity but different threshold. For the parameters we 
use: t = 50, pi — 0.0012, p 2 — 0.48, ms — mw — 3, 
ms,w — mw,s — 2, Ts — 0.3, Tw -— 0.7. The larger the 
Th value, the less resilient the network. We obtain that both 
networks exhibit the same hysteresis. The parameters are set 
in a part of phase space to enable phase flipping between ac¬ 
tive and inactive states. However, due to different thresholds, 
network S is more resilient than network W—the average frac¬ 
tion of active nodes in network S is practically always larger 
than in network W. 


can be arbitrarily chosen depending on real world exam¬ 
ples. Each competing network is formed by the intra¬ 
network connections between its own nodes, while inter¬ 
actions between competing networks are determined by 
inter-network connections between nodes from two op¬ 
posing competitor networks. We also assumed static 
intra-network and inter-network connections, while in 
different real world examples these connections can also 
change through time and depend on different spatial and 
temporal attributes. 

When we represent both an attacker or attacked sys¬ 
tem as a network, we must also decide which attributes 
and level of details of the system are of interest for a spe¬ 
cific real-world scenario. A single node in network repre¬ 
sents a particular component of a system or aggregated 
set of similar components, while the consequences of an 
attack are described by an active or an inactive node’s 
state. The global collective state of both the attacker and 
the attacked network is measured by the total fraction of 
active nodes in each network. Finally, the interpretation 
of node’s activity and inactivity depends on the applica¬ 
tion context of different real world attack scenarios. 

In order to explain the general network vulnerabil¬ 
ity to global cascades of local and external node fail¬ 
ures/inactivations caused by attack consequences, we 
model node dynamics by a cascade contagion model with 
stochastic internal and external activation/inactivation 
process [3], inspired by the Watts threshold model 
[5] where each node has a probability to internally 
fail/inactivate independently of other nodes. At the same 
time, the probability to externally fail/inactivate if a frac¬ 
tion of its active intra-network and inter-network neigh¬ 
bors is less than or equal to a specified fractional thresh¬ 
old. This fractional threshold can be interpreted as the 
network resilience to failures due to interdependencies, 
the larger the value of the fractional threshold, the less 
resilient the network. 

We assume that the attacker network has a higher re¬ 
silience than an opponent network and that it is willing 
to partially weaken its own resilience in order to more 
severely damage a less resilient competitor. Attack con¬ 
cept and also its influence on resilience dynamics of the 
attacker is based on causing critical fraction of active 
neighbors for nodes from an opponent network, and us¬ 
ing takeover and substitution mechanisms for them af¬ 
ter their long inactivity. However, this concept is highly 
context-dependent and its mechanisms have to be prop¬ 
erly mapped in regard to different real work scenarios. 

As the attacker network has higher resilience than 
an opponent network it can induce the implicit indi¬ 
rect attack by increasing the probability of internal fail¬ 
ures/inactivations of its nodes causing critical fraction 
of active neighbors for nodes from an opponent network. 
In addition, takeover and substitution mechanisms define 
direct attack on an opponent network. Takeover mech¬ 
anism is related to the explicit attack on an opponent 
network with the same type of nodes as the attacker 
network and the explicit reduction of the attacker net- 




























work resilience by increasing its fractional threshold. On 
the other hand, the substitution mechanism represents 
the explicit attack on an opponent network with implicit 
reduction of the attacker network resilience by having 
nodes whose state is more dependent on nodes form the 
opponent networks. 

Although we focus on the most simplified scenario of 
two interactive competing networks where just one and 
more resilient network can attack a less resilient opponent 
network, the introduced framework provides the basis for 
more general scenarios of alliances of more different net¬ 
works with also different interaction types between them 
(e.g. competing intra-specific/network, antagonistic, mu- 
tualistic) and strategies for attack as well as defense. How 
many new parameters have to be introduced for this sce¬ 
nario also depends highly on the context of the study of 
interest. We can observe each network collective state 
and resilience dynamics separately or depending on their 
affiliation while a specific attack or defense strategy is 
taking place. 

How successful our network model might be when ap¬ 
plied in practice depends first on how capable we are in 
estimating model parameters and mapping them to real- 
world context. As described before our model is struc¬ 
tured with the architecture of intra-network and inter¬ 
network connections which define networks structure and 
constraints for an interaction, and with parameters for 
cascade dynamics including internal and external failure 
probabilities, the fractional threshold and the limit for 
inactivity period. We show how these parameters can 
be mapped to two real world scenarios from ecology and 
political socio-economy application domains. 


A. Socio-economic system: competing inter-firm 
network of countries under economic sanctions 

Here we demonstrate how our modeling framework 
is mapped to a specific political-socio-economic scenario 
where one country imposes economic sanctions or similar 
political-economic attack/action against another coun¬ 
try. In this regard we explain interpretation of model 
parameters, intra/inter-network architecture and activa¬ 
tion/inactivation dynamics. A critical aspect of political- 
economic attack/action is the economic costs endured 
not only by the targeted country, but also by the sender 
country (the one making the action). Although, we are 
focusing here on the most simplest case of bilateral eco¬ 
nomic interdependence between just two countries, such 
actions can also bring to economic consequences to other 
third parties like neighbours countries of the target or its 
trading partners, but as well as senders. Economic sanc¬ 
tions are deliberate, government-inspired withdrawal, or 
threat of withdrawal, of customary trade or financial re¬ 
lations and are most effective when aimed against friends 
and close trading partners as these countries have more 
to lose than countries with which the sender has limited 
or adversarial relations. 


Interdependent links established between countries 
during prosperous times can facilitate sanctions (inten¬ 
tional fluctuations) that are used as a weapon when more 
resilient countries try to overcome less resilient coun¬ 
tries. They can also facilitate the global propagation of 
economic recessions (spontaneous fluctuations). During 
long economic crises these interdependent links can be¬ 
come fatal for less resilient countries. Similarly, when 
economic sanctions are lifted for the weaker economies is 
much harder to restore than for the stronger economics 
which recover after suffering little damage. 

In order to explain the economic cost for the coun¬ 
try imposing the sanctions, we first specify state of the 
country’s economic system by collective activity of in¬ 
dividual firms which are part of the country economy. 
Firms are connected to each other directly or indirectly 
through their business transactions (i.e. obtaining ma¬ 
terials from suppliers, delivering goods/products to ser¬ 
vices or R&D cooperation). Economic network of each 
country is represented by inter-firm network assuming 
that intra-network connections specify cooperative inter¬ 
actions between firms of same country, and inter-network 
connections specify interactions between firms in differ¬ 
ent countries that are subjected to the bilateral economic 
relation between two countries. 

As many firms borrow from and lend to each other, and 
in particular when these firms are speculative and depen¬ 
dent on the credit flow, shocks to the liquidity of some 
firms may cause the other firms to also experience finan¬ 
cial difficulties [6]. The way how geographically localized 
shock propagate through such inter-firms networks de¬ 
termines country resilience to the shock experienced by 
their corresponding firms. These dynamic vulnerabilities 
of firms can be related to the fractional threshold param¬ 
eter that can be controlled by its asset-debt ratio where 
activity/inactivity of a firm is determined by its solvency 
(see SI. Resilience dynamics in finance). 

The attack concepts is related to inducing the im¬ 
plicit indirect attack by increasing probability of internal 
failures/inactivations of its firms causing target country 
firms to become insolvent. In addition, takeover mech¬ 
anisms define attack on the target country economy by 
taking over their firms which are insolvent for some crit¬ 
ical time. 

The extension of our modeling framework from bilat¬ 
eral economic interdependence between just two inter¬ 
firm networks of competing countries to more general 
scenarios of network alliances where some countries unite 
in order to attack some other alliance is especially in¬ 
teresting when we introduce the resilience heterogeneity 
of allied attacker countries. The resilience heterogene¬ 
ity of allied attackers can induce opposing interests and 
attack strategies between partners as well as provide de¬ 
scriptions of scenarios where economically most domi¬ 
nant countries increase their dominance relative to other 
countries and at the expense of their partner countries 
in the alliance or where, on the other hand, economically 
strong countries depend on alliance’s weakest country. 
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For example, suppose two countries, I and II imposing 
economic sanctions at the third country, III, where I is 
more resilient than II and both I and II are more resilient 
than III. A country resilience can be different since II 
is more linked with III than I. When the sanctions are 
lifted, the relative resilience between I and II can be in¬ 
creased making I even more dominant than before the 
sanctions. But on the other hand due to the interdepen¬ 
dencies between allied countries, i.e. countries I and II, 
attack strategy of I is dependent also on the state of II. 


B. Ecological system: competing animal social 
networks under predator-prey interactions 

Here we demonstrate how our modeling framework is 
mapped to two competing animal social networks under 
predator-prey interactions. We explain possible choices 
and an interpretation for intra/inter-network structures 
and activation/inactivation dynamics for a specific sce¬ 
nario where individuals from one predator species attack 
individuals from one prey species. A predator is an an¬ 
imal that hunts and kills other animals (its preys) for 
food. An interpretation of predators and preys inter¬ 
nal or external activity depends on the given context 
of the study of interest and the interpretation of their 
intra/inter-network connections. 

The intra-network structure for attacking (predator) 
and attacked (prey) networks can be represented by cor¬ 
responding socio-spatial network of their individuals la¬ 
ma. While, inter-network connections, i.e. connections 
between predator and prey individuals, determine which 
predator individuals can come in close contact with which 
prey individuals to hunt them based on spatial and tem¬ 
poral factors. Interactions between animal individuals 
are highly dependent on their spatial proximity. Thus 
determining the structure of social animal network also 
depends on given spatial context |7]. Recent technolog¬ 
ical innovations in tracking devices and reality mining 
approaches are starting to enable remote monitoring and 
collection of detailed information of behaviors of indi¬ 
vidual animals at high spatial and temporal resolution 

mm- 

A structure of social network between animal individ¬ 
uals influence diversity of social behaviors such as find¬ 
ing and choosing a sexual partner, making movement de¬ 
cisions, engaging in foregoing or anti-predator behavior 
which is manifested at the population level in the form 
of habitat use, mating systems, information or disease 
transmission. Social interactions between individuals of 
same species can differ in their type (competitive, cooper¬ 
ative, sexual), frequency and duration. Animals modify 
their social interactions in response to changes in exter¬ 
nal conditions such as climate, predation pressure, and 
social environment |7,. Although, interactions among an¬ 
imals are dynamic, many animal social network studies 
examine static structures. 

For a simplified predator-prey interaction scenario we 


can assume static cooperative interactions and that there 
are no competing interactions between individuals of the 
same species, i.e. infraspecific competition is not taken 
into account. Cooperating interactions between individ¬ 
uals play an important role in the spreading of informa¬ 
tion within the network affecting an access to resources 
and the probability of predation of an individual. For 
example, individuals that have large number of intra¬ 
network connections can be better in discovering new 
food patches. 

With that interpretation of the intra-network and 
inter-network connections, we can model predators coor¬ 
dinated attack by their activation dynamics. In this con¬ 
text it is reasonable to assume that a node in attacked 
(prey) network will externally fail (be killed by preda¬ 
tors) if there is enough activated predators (i.e. fraction 
of active inter-neighbors larger then given threshold) that 
are in close range of the prey (i.e. those connected with 
inter-network connections). As usual, prey can also ex¬ 
ternally fail (die or migrate) if its fraction of active intra¬ 
neighbors is equal or smaller then the fractional thresh¬ 
old. In this context we can interpret internal and external 
failure/activation probabilities, and the limit for inactiv¬ 
ity period for predators as their opportunity, exigency 
and willingness to hunt prey together in certain time. 
While those parameters in prey’s case can be interpret 
as a way how prey sustains predators attacks or keeps a 
certain habitat patch active with its own species through 
reproduction. Prey organisms that are difficult to find, 
catch, kill or consume will survive and reproduce. 

The explained attack concept is in contrast to the in¬ 
direct attack concept where inactive/failed states of at¬ 
tacker nodes cause external failure of attacked network 
nodes. This assumption is reasonable in a scenario where 
inter-network connections represent prey dependencies 
on its predators, i.e. where for each prey there is a needed 
fraction of active predators for them to survive because 
the active predators balance the population size of a prey 
(see also section S3. Coupled BA interdependent net¬ 
works with equal connectivity but different threshold). In 
that scenario, predators and prey depend on each other in 
that the predators rely on prey as food source, but in turn 
they also keep prey population against over-population 
which could cause decrease of their food source. Beside 
that, in some cases prey species can even facilitate its own 
predator M- A possible context that relies on predator 
and prey interdependence is explanation of how a disease 
or other internal disturbances in predator population can 
effect prey population dynamics and vice versa. 

In contrast to socio-economic scenario of competing 
network of countries’ firms, takeover mechanism is not 
suitable attack concept for scenario of predator-prey in¬ 
teractions where we model interaction between social net¬ 
work of different node types, but substitution mechanism 
is suitable to represent additional level of predation influ¬ 
ence on prey population. In general predation influences 
organisms at two ecological levels. At the level of the in¬ 
dividual, the prey organism has an abrupt decline of its 


V 


lifetime reproductive success, because it will never repro¬ 
duce again, and at the level of the community, predation 
reduces the number of individuals in the prey popula¬ 
tion. Accordingly, the direct cost for strong predator 
which easily hunts and kills its prey is generally negligi¬ 
ble, but indirect cost can be manifested through the fact 
that each reduction in prey abundance impedes finding a 
next prey. On the other hand, the direct cost is notice¬ 
able for intraguild predators, predators that kill and eat 
other predators of different species at the same trophic 
level [SHE]- 

Classical models of predator-prey population dynam¬ 
ics, often considered as the basic building blocks of larger, 
food-web models, explain how tropic interactions lead 
to oscillatory population cycles. These models assume 
well-mixed population where all pairs of individuals have 
equal probabilities of interacting with each other which 
corresponds to a complete graph structure. This means 
that the encounter rate between predators and prey is 
expressed in a mass-action fashion, i.e. as a product of 
prey and predator landscape densities m- Our model 
can describe mechanistic approach of predator-prey in¬ 
teractions within structured population of individuals of 
two animal species. 

Animal social networks are harder to determine and 
observe than human social networks as animal network 
data must be collected by direct observation of interac¬ 
tions between individual animals mm- For some large 
herding species it may be possible to count every indi¬ 
vidual, but for many species this is not possible. In cases 


when is too time consuming to collect animal network 
data at individual level due to difficulties of capturing 
and identifying individuals, it can be useful to observe 
categories of individuals and consider interactions be¬ 
tween them. Since spatial proximity is significant factor 
for establishing and maintaining cooperation between in¬ 
dividuals, we can observe interactions between predators 
and prey through patches they occupy nang. 

While in social animal networks, one node represents 
just a single individual of a given species and each edge 
represents some form of interaction between two indi¬ 
viduals, in food webs and ecological network studies a 
node typically represents a species while connections be¬ 
tween nodes represent different types of interactions be¬ 
tween species. Species may interact with each other 
through antagonism (prey-predator, host-parasitoid, or 
host-parasite interaction), competition, or mutualism 
m- Food webs can provide initial blueprints of inter¬ 
connections between animal socio-spatial networks when 
extending our modeling framework from interaction be¬ 
tween just two species networks to more general scenario 
of network alliances where several predator and/or prey 
networks can cooperate or compete between each other. 
For example, in the case when two prey species have 
a common predator, one prey species can lead to indi¬ 
rect exclusion of the other species or the case where two 
predators alone compete for a single prey species, one 
species is always excluded by the other, even in the pres¬ 
ence of a top predator. 
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